Sysinternals Antivirus Rogue Anti-Spyware - removal guide

Sysinternals Antivirus

Created: 2010-06-08 07:28:48 Author: Gaby C.

Information about Sysinternals Antivirus

Sysinternals Antivirus is a fake anti-spyware tool that pretends to detect malware and offers its paid version to remove these detections. For ripping people off, it also poses to be a program from Sysinternals troubleshooting utilities suite.

Just like other rogues from Your PC Protector family, Windows Police Pro and AKM Antivirus 2010 Pro, Sysinternals Antivirus unregistered software usually spreads through security vulnerabilities found. In this way, Trojans get into the potential host system secretly and then install malwares such as Sysinternals Antivirus. Once inside, malicious trialware induces the system to run it each time user logs in, so after computer boots up Sysinternals Antivirus appears on the desktop. In fact, there are tons of continuous system scanners that pretend to check the PC for malware and then detect totally fabricated and basically non-existent infections. Some of these alerts read:

Warning: Infection is Detected

Windows has found spyware infection on your computer! Click here to update antivirus software…

svchost.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
If you were in the middle of something, the information you were working on might be lost.
Please tell Microsoft about this problem.

We have created an error report that you can send to us. We will treat this report as confidential and anonymous.

Security Alert!
Infiltration Alert!
Your computer is being attacked by an Internet Virus. It could be a password-stealing attack, a trojan-dropped or similar.

Then, in order to remove the reported parasites, victims are prompted to download and install Sysinternals Antivirus commercial software. However, it’s important to realize that purchasing it is a worthless thing to do. This program is a rogue anti-spyware which either cannot be helpful in any way, or its unregistered version is safe to have on the computer. If you suspect that this rogue is installed in your system, you should immediately perform a full system scan and remove Sysinternals Antivirus if spotted. A delay of removal may lead to system damage and PC performance deterioration. Get rid of Sysinternals Antivirus which is not legitimate application.

Sysinternals Antivirus Facts

For automatic Sysinternals Antivirus removal, please download Spyware Doctor:

Spyware Doctor

Sysinternals Antivirus pretends to increase security of your PC
Sysinternals Antivirus free version will show popups, alerts and fake results to convince you to pay
Sysinternals Antivirus creators will not deliver license keys upon paying or the full version will not be functional
Sysinternals Antivirus might be used to download and advertise other malicious software
Sysinternals Antivirus might disable some of your PCs or its programs functions

Manual Sysinternals Antivirus removal instructions

Note: Manual removal of parasite Sysinternals Antivirus is tedious and dangerous task if done incorectly. Stoping and deleting incorrect executables and DLLs, deleting registry entries might harm your PC. Thus we recommend using Spyware Doctor of PCTools for automatical scan and removal of computer parasites, or another reputable spyware remover.

1

Kill malicious Processes:

How to kill malicious processes

alggui.exe
svchost.exe
Sysinternals Antivirus.exe
dbsinit.exe
ccsmn.exe
ccsrr.exe

2

Unregister malicious Dlls:

How to unregister malicious DLLs

adc32.dll
adc_w32.dll

3

Remove malicious Registery entries:

How to remove malicious registry entries

HKCU\Software\Sysinternals Antivirus
HKCR\CLSID\{77DC0Baa-3235-4ba9-8BE8-aa9EB678FA02}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77DC0Baa-3235-4ba9-8BE8-aa9EB678FA02}
HKLM\SYSTEM\CurrentControlSet\Services\AdbUpd
HKEY_CURRENT_USER\Software\Sysinternals Antivirus
HKEY_CLASSES_ROOT\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "novavapp"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "novavappr"

4

Remove harmful Files:

How to remove harmful files

c:\Program Files\adc_w32.dll
c:\Program Files\alggui.exe
c:\Program Files\extra1.dat
c:\Program Files\extra2.dat
c:\Program Files\nuar.old
c:\Program Files\skynet.dat
c:\Program Files\svchost.exe
c:\Program Files\wp3.dat
c:\Program Files\wp4.dat
c:\Program Files\scdata
c:\Program Files\scdata\dbsinit.exe
c:\Program Files\scdata\wispex.html
c:\Program Files\scdata\images
c:\Program Files\scdata\images\i1.gif
c:\Program Files\scdata\images\i2.gif
c:\Program Files\scdata\images\i3.gif
c:\Program Files\scdata\images\j1.gif
c:\Program Files\scdata\images\j2.gif
c:\Program Files\scdata\images\j3.gif
c:\Program Files\scdata\images\jj1.gif
c:\Program Files\scdata\images\jj2.gif
c:\Program Files\scdata\images\jj3.gif
c:\Program Files\scdata\images\l1.gif
c:\Program Files\scdata\images\l2.gif
c:\Program Files\scdata\images\l3.gif
c:\Program Files\scdata\images\pix.gif
c:\Program Files\scdata\images\t1.gif
c:\Program Files\scdata\images\t2.gif
c:\Program Files\scdata\images\Thumbs.db
c:\Program Files\scdata\images\up1.gif
c:\Program Files\scdata\images\up2.gif
c:\Program Files\scdata\images\w1.gif
c:\Program Files\scdata\images\w11.gif
c:\Program Files\scdata\images\w2.gif
c:\Program Files\scdata\images\w3.jpg
c:\Program Files\scdata\images\word.doc
c:\Program Files\scdata\images\wt1.gif
c:\Program Files\scdata\images\wt2.gif
c:\Program Files\scdata\images\wt3.gif
c:\Program Files\Sysinternals Antivirus
c:\Program Files\Sysinternals Antivirus\Sysinternals Antivirus.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.acf
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.ltd
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.lti
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.acb
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.aci
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.mt
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsrr.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\lleod150
%UserProfile%\Application Data\Microsoft\Internet Explorer\wmharun.log
%UserProfile%\Application Data\Microsoft\Internet Explorer\wmrun.log
%UserProfile%\Start Menu\Programs\Sysinternals Antivirus
%UserProfile%\Start Menu\Programs\Sysinternals Antivirus\Sysinternals Antivirus.lnk

5

Scan your System:

Scan your System with free scanners for remaining computer parasites

*Name
*E-mail

AWM Antivirus

Created: 2010-08-27 08:13:50 Author:Gaby C.

AWM Antivirus can be called a typical scam because in reality it just like its earlier variant A-Fast Antivirus pretends to be a reputable security program capable to detect all these viruses that are usually reported. Being taken to the category of rogue anti-spywares, it seeks to convince people about the need of its commercial version and, after reporting numerous viruses, declares that only its “full” version will remove them from the PC. However, don’t dream that...

Posted in: Rogue Anti-Spyware

No comments yet

AV Antivirus Suite

Created: 2010-06-30 08:17:35 Author:Gaby C.

AV Antivirus Suite is a fake spyware remover that uses Trojans or other methods for its distribution which mostly stays undetected. AVAntivirusSuite then applies dishonest methods on user’s computer trying to make him think that he urgently needs its “full” version. The sad news is that you must stay away from and never purchase AVAntivirusSuite just like the earlier its variants AV Security Suite or Antispyware Soft. So follow removal instructions below if you think that...

Posted in: Rogue Anti-Spyware

1 comments

Antivirus Scan

Created: 2011-01-24 04:04:14 Author:Gaby C.

Antivirus Scan is a clear example of rogue anti-spyware which was created for ripping PC users off. For that malware pretends to be useful and powerful enough to find all the viruses on every computer and then offers to purchase its removal services. However, in reality AntivirusScan has no virus data base, so it can’t find or remove any kind of cyber threat. That’s why in order to scare you into purchasing its licensed version it “detects” and then reports invented...

Posted in: Rogue Anti-Spyware

No comments yet